Fix an elusive bug

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index d798e5f59d29d1422d48c7e1fd609d45b68b6de2..53514d1c3be25f0a449dcce2ef1cef2a7e747f11 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -332,11 +332,12 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
        if (PZVAL_IS_REF(variable_ptr)) {
                if (variable_ptr!=value) {
                        short refcount=variable_ptr->refcount;
+                       zval garbage;
        
                        if (type!=IS_TMP_VAR) {
                                value->refcount++;
                        }
-                       zendi_zval_dtor(*variable_ptr);
+                       garbage = *variable_ptr;
                        *variable_ptr = *value;
                        variable_ptr->refcount = refcount;
                        variable_ptr->is_ref = 1;
@@ -344,6 +345,7 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
                                zendi_zval_copy_ctor(*variable_ptr);
                                value->refcount--;
                        }
+                       zendi_zval_dtor(garbage);
                }
        } else {
                variable_ptr->refcount--;